String searching engine for virus scanning

IEEE Transactions on Computers

Volumn 60, Issue 11, 2011, Pages 1596-1609

  Pao, Derek ^a   Wang, Xing ^a   Wang, Xiaoran ^b   Cao, Cong ^a   Zhu, Yuesheng ^b  

^a CITY UNIVERSITY OF HONG KONG   (Hong Kong)

^b PEKING UNIVERSITY   (China)

Author keywords

antivirus system; embedded system.; String searching; system security

Indexed keywords

AHO-CORASICK; ANTI VIRUS; ANTI-VIRUS SYSTEMS; HARDWARE CIRCUITS; INPUT STREAMS; LOOK UP TABLE; MEMORY COST; PATTERN SET; STRING-SEARCHING; SYSTEM SECURITY; VIRUS SCANNING;

SEARCH ENGINES; VIRUSES;

TABLE LOOKUP;

EID: 80053463355     PISSN: 00189340     EISSN: None     Source Type: Journal    
DOI: 10.1109/TC.2010.250     Document Type: Article

References (27)

1. A.V. Aho and M.J. Corasick, "Efficient String Matching: An Aid to Bibliographic Search," Comm. ACM, vol. 18, no. 6, pp. 333-340, 1975.
2. M. Alicherry, M. Muthuprasanna, and V. Kumar, "High Speed Matching for Network IDS/IPS," Proc. IEEE Int'l Conf. Network Protocols, pp. 187-196, 2006.
3. Z.K. Baker and V.K. Prasanna, "A Computationally Efficient Engine for Flexible Intrusion Detection," IEEE Trans. Very Large Scale Integration (VLSI) Systems, vol. 13, no. 10, pp. 1179-1189, Oct. 2005. (Pubitemid 43131684)
4. Z.K. Baker and V.K. Prasanna, "Automatic Synthesis of Efficient Intrusion Detection Systems on FPGAs," IEEE Trans. Dependable and Secure Computing, vol. 3, no. 4, pp. 289-300, Oct.-Dec. 2006. (Pubitemid 44837032)
5. Y.H. Cho and W.H. Mangione-Smith, "Fast Reconfiguring Deep Packet Filter for 1 Gigabit Network," Proc. IEEE Symp. Field-Programmable Custom Computing Machines, 2005.
6. ClamAV anti-virus software, http://www.clamav.net, 2011.
7. C.R. Clark and D.E. Schimmel, "Efficient Reconfigurable Logic Circuits for Matching Complex Network Intrusion Detection Patterns," Proc. Int'l Conf. Field-Programmable Logic and Applications, pp. 956-959, 2005.
8. S. Dharmapurikar, P. Krishnamurthy, T.S. Sproull, and J.W. Lockwood, "Deep Packet Inspection Using Parallel Bloom Filters," IEEE Micro, vol. 24, no. 1, pp. 52-61, Jan.-Feb. 2004.
9. S. Dharmapurikar and J. Lockwood, "Fast and Scalable Pattern Matching for Network Intrusion Detection Systems," IEEE J. Selected Areas in Comm., vol. 24, no. 10, pp. 1781-1792, Oct. 2006.
10. V. Dimopoulos, I. Papaefstathiou, and D. Pnevmatikatos, "A Memory-Efficient Reconfigurable Aho-Corasick FSM Implementation for Intrusion Detection Systems," Proc. IEEE Int'l Conf. Embedded Computer Systems: Architectures, Modeling and Simulations, pp. 186-193, 2007.
11. D. Ficara, S. Giordano, S. Kumar, and B. Lynch, "Divide and Discriminate: Algorithm for Deterministic and Fast Hash Lookups," Proc. ACM/IEEE Symp. Architectures for Networking and Comm. Systems (ANCS), pp. 133-142, 2009.
12. J.T.L. Ho and G.F. Lemieux, "PERG: A Scalable FPGA-Based Pattern-Matching Engine with Consolidated Bloomier Filters," Proc. IEEE Int'l Conf. Field-Programmable Technology, pp. 73-80, Dec. 2008.
13. N. Hua, H. Song, and T.V. Lakshman, "Variable-Stride Multi-Pattern Matching for Scalable Deep Packet Inspection," Proc. IEEE INFOCOM, pp. 415-423, 2009.
14. D. Knuth, J. Morris, and V. Pratt, "Fast Pattern Matching in Strings," SIAM J. Computing, vol. 6, pp. 323-350, 1977.
15. J. van Junteren, "Searching Very Large Routing Tables in Wide Embedded Memory," Proc. IEEE Global Telecomm. Conf. (GlobeCom), pp. 1615-1619, 2001.
16. J. van Lunteren, "High-Performance Pattern-Matching for Intrusion Detection," Proc. IEEE INFOCOM, pp. 1-13, 2006.
17. D. Pao, W. Lin, and B. Liu, "Pipelined Architecture for Multi-String Matching," IEEE Computer Architecture Letters, vol. 7, no. 2, pp. 33-36, July-Dec. 2008.
18. D. Pao, W. Lin, and B. Liu, "A Memory Efficient Pipelined Implementation of the Aho-Corasick String Matching Algorithm," ACM Trans. Architecture and Code Optimization, vol. 7, no. 2, pp. 1-27, 2010.
19. D. Pao, "A NFA-Based Programmable Regular Expression Match Engine," Proc. ACM/IEEE Symp. Architectures for Networking and Comm. Systems (ANCS), pp. 60-61, 2009.
20. G. Papadopoulos and D. Pnevmatikatos, "Hashing + Memory = Low Cost, Exact Pattern Matching," Proc. IEEE Int'l Conf. Field Programmable Logic and Applications, pp. 39-44, 2005. (Pubitemid 44183407)
21. Snort intrusion detection system, http://www.snort.org, 2011.
22. T. Song, W. Zhang, D. Wang, and Y. Xue, "A Memory Efficient Multiple Pattern Matching Architecture for Network Security," Proc. IEEE INFOCOM, pp. 673-681, 2008.
23. I. Sourdis and V. Pnevmatikatos, "Pre-Decoded CAMs for Efficient and High-Speed NIDS Pattern Matching," Proc. 12th IEEE Symp. Field-Programmable Custom Computing Machines, 2004.
24. I. Sourdis, V. Pnevmatikatos, and S. Vassiliadis, "Scalable Multigigabit Pattern Matching for Packet Inspection," IEEE Trans. Very Large Scale Integration (VLSI) Systems, vol. 16, no. 2, pp. 156-166, Feb. 2008.
25. L. Tan, B. Brotherton, and T. Sherwood, "Bit-Split String-Matching Engines for Intrusion Detection and Prevention," ACM Trans. Architecture and Code Optimization, vol. 3, no. 1, pp. 3-34, 2006.
26. N. Tuck, T. Sherwood, B. Calder, and G. Varghese, "Deterministic Memory-Efficient String Matching Algorithms for Intrusion Detection," Proc. IEEE INFOCOM, pp. 2628-2639, 2004.
27. F. Yu, R.H. Katz, and T.V. Lakshman, "Gigabit Rate Packet Pattern-Matching Using TCAM," Proc. IEEE Int'l Conf. Network Protocols, pp. 174-183, 2004. (Pubitemid 40574708)